CVE-2020-5398High· 7.5▾ MidnightPoC availableIn Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 17.7 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
89%
1 GitHub repo (last check)
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
spring_framework >= 5.0.0, < 5.0.16spring_framework >= 5.1.0, < 5.1.13spring_framework >= 5.2.0, < 5.2.3application_testing_suite = 13.3.0.1communications_billing_and_revenue_management_elastic_charging_engine = 11.3communications_billing_and_revenue_management_elastic_charging_engine = 12.0communications_cloud_native_core_policy = 1.5.0communications_diameter_signaling_router >= 8.0.0, <= 8.2.2communications_element_manager = 8.1.1communications_element_manager = 8.2.0communications_element_manager = 8.2.1communications_policy_management = 12.5.0communications_session_report_manager = 8.1.1communications_session_report_manager = 8.2.0communications_session_report_manager = 8.2.1communications_session_route_manager = 8.1.1communications_session_route_manager = 8.2.0communications_session_route_manager = 8.2.1enterprise_manager_base_platform = 13.2.1.0financial_services_regulatory_reporting_with_agilereporter = 8.0.9.2.0flexcube_private_banking = 12.0.0flexcube_private_banking = 12.1.0healthcare_master_person_index = 4.0.2insurance_calculation_engine >= 11.0.0, <= 11.3.1insurance_policy_administration_j2ee = 10.2.0insurance_policy_administration_j2ee = 10.2.4insurance_policy_administration_j2ee = 11.0.2insurance_policy_administration_j2ee = 11.1.0insurance_policy_administration_j2ee = 11.2.0insurance_policy_administration_j2ee = 11.2.2.0insurance_rules_palette = 10.2.0insurance_rules_palette = 10.2.4insurance_rules_palette = 11.0.2insurance_rules_palette = 11.1.0insurance_rules_palette = 11.2.0mysql >= 4.0.0, <= 4.0.12mysql >= 8.0.0, <= 8.0.20rapid_planning = 12.1rapid_planning = 12.2retail_assortment_planning = 15.0retail_assortment_planning = 16.0retail_back_office = 14.1retail_bulk_data_integration = 16.0.3.0retail_central_office = 14.1retail_financial_integration = 15.0retail_financial_integration = 16.0retail_integration_bus = 15.0.3retail_integration_bus = 16.0.3retail_order_broker = 15.0retail_order_broker = 16.0retail_point-of-service = 14.1retail_predictive_application_server = 14.0.3retail_predictive_application_server = 14.1.3.0retail_predictive_application_server = 15.0.3retail_predictive_application_server = 16.0.3.0retail_returns_management = 14.1retail_service_backbone = 15.0retail_service_backbone = 16.0siebel_engineering_-_installer_&_deployment <= 2.1.1weblogic_server = 12.2.1.3.0weblogic_server = 12.2.1.4.0data_availability_servicessnapcenterUpgrade past the affected range:
spring_framework 5.2.3Connected by shared product, vendor, weakness, or advisory.
CVE-2018-11040High· 7.5Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for R…
CVE-2022-22971Medium· 6.5In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.
CVE-2022-22968Medium· 5.3In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with b…
CVE-2018-1270Critical· 9.8Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging…
CVE-2020-5421Medium· 6.5In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the …
CVE-2018-1257Medium· 6.5Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messagi…